TLS certificates and HTTPS listeners

Validate certificate material, activate revisions, and rotate certificates before expiry.

HTTPS listeners terminate client TLS using a certificate reference available to the load balancer. Backend encryption is configured separately from the public listener.

Import a certificateCopy link

Create a TLS secret with the leaf certificate, intermediate chain, and matching private key. Infra validates the key pair and parses certificate validity before accepting the revision. A mismatched key or malformed chain is rejected without changing the active listener.

The private key becomes write-only after import. Readers see its certificate fingerprint, covered names, validity period, and secret revision. Do not include the key in blueprints or ordinary resource exports.

Attach and validateCopy link

Choose Load balancer → Listeners → HTTPS and select the certificate reference. The preview checks that the requested hostname is covered and the secret is permitted for this service. A certificate for a different name does not become valid because DNS points to the listener address.

The operation distributes a listener revision. The details view distinguishes the desired certificate from the active fingerprint. Verify the served certificate from an external client before closing a rotation task.

Rotate without losing the old referenceCopy link

1. Open Settings → Secrets, select the TLS secret, and import the replacement certificate, chain, and private key as a new revision.
2. Open Load balancer → Listeners → HTTPS, select the replacement certificate reference, and submit the listener update.
3. Follow the update operation and compare each instance's active fingerprint with the replacement. A pending instance can still serve the old certificate.
4. Connect from an external client using the service hostname. Confirm its certificate fingerprint, chain, hostname coverage, and validity.

Keep the old revision while an instance or rollback plan still needs it. An accepted listener update alone does not establish that every instance adopted the replacement.

An expired certificate can remain installed even though clients reject it. Configure expiry alerts early enough to complete issuance, approval, and rollout. Alert acknowledgement does not renew or replace certificate material.

Backend TLSCopy link

For HTTPS backends, configure the expected server name and trusted issuer chain. The backend connection can fail verification even when public TLS is valid. Use the backend health diagnostic to distinguish handshake failure from an HTTP readiness response.

Disabling backend verification is an explicit policy-controlled setting. It changes authentication of the backend endpoint and should not be used as an unexplained fix for a hostname mismatch.

Secret revocation and deletionCopy link

A referenced TLS secret cannot be deleted. Move the listener to a replacement, verify its active revision, and remove old references first. Revoking an external certificate or losing its private key requires a new issuance; editing the resource display name does not change the served material.

Use Load balancer API, Secrets API, and connection draining when a listener change also requires an application deployment.